Overview

overview

8

Static

static

3

Roblox.Acc....1.zip

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    254s
  • max time network
    246s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/05/2026, 16:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Roblox.Account.Manager.3.6.1.zip
  • Size 4.0MB
  • Sample260503-vb22xahs5r
  • SHA256 1b94210a7a05ce8379db7b8c11d41f84bc868cbdcd0685733754728678bb5fa2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarecredential_accessdiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 38 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 49 IoCs
  • Drops file in Windows directory 25 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 16 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Roblox.Account.Manager.3.6.1.zip
    1⤵
      PID:5496
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3496
      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:2348
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e518c728,0x7ff9e518c734,0x7ff9e518c740
          2⤵
            PID:3012
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,10729266499888506019,7561410058118679225,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2148 /prefetch:11
            2⤵
            • System Time Discovery
            PID:5704
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,15236378399894648534,12563418555431146822,262144 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2100 /prefetch:2
            2⤵
              PID:6044
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,9459883535736193364,410061030377421235,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2388 /prefetch:13
              2⤵
                PID:5832
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,9819519450226735293,2812019396129847924,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3488 /prefetch:1
                2⤵
                  PID:2012
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,17742627031633861105,8838554142292412661,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3440 /prefetch:1
                  2⤵
                    PID:1676
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,12363247600960723779,8979165133104758851,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:9
                    2⤵
                      PID:1840
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4508,i,5885364699610625457,15504727990136458311,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4648 /prefetch:1
                      2⤵
                        PID:2080
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,3419342437895625406,14397593876030684137,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5420 /prefetch:14
                        2⤵
                          PID:5260
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5684,i,11862868879356252955,18440075225577871939,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5700 /prefetch:1
                          2⤵
                            PID:2024
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3620,i,7304791852769947359,16485710452561959948,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3572 /prefetch:1
                            2⤵
                              PID:3736
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4560,i,7539696563515545631,14259510602154240278,2097152 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4572 /prefetch:1
                              2⤵
                                PID:6084
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,8517774703270550217,8068567567433518030,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:14
                                2⤵
                                • NTFS ADS
                                PID:3356
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6532,i,1663434810669263001,357618953136870632,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6484 /prefetch:14
                                2⤵
                                  PID:4788
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,15783517234696636674,1477621016645787459,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6404 /prefetch:14
                                  2⤵
                                    PID:4784
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,3477730651616707203,13580343267982337950,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6232 /prefetch:14
                                    2⤵
                                      PID:4484
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5024,i,8421996856368189569,16294854340501156332,262144 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5576 /prefetch:10
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5716
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=872,i,17343032608056553486,7261427321859262817,524288 --field-trial-handle=2120,i,5707117822765635033,7234012830144071710,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5784 /prefetch:14
                                      2⤵
                                        PID:2368
                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                      1⤵
                                        PID:5052
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                        1⤵
                                          PID:5016
                                        • C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
                                          "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe"
                                          1⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:1600
                                          • C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
                                            "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe" -restart
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies Internet Explorer settings
                                            • Suspicious use of WriteProcessMemory
                                            PID:3452
                                            • C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
                                              "C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:2212
                                              • C:\Windows\Temp\{0C4DA008-F976-43DF-9882-35608CC61EF5}\.cr\vcredist.tmp
                                                "C:\Windows\Temp\{0C4DA008-F976-43DF-9882-35608CC61EF5}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=584 -burn.filehandle.self=732 /q /norestart
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:3300
                                                • C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\.be\VC_redist.x86.exe
                                                  "C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{3FD65B46-DB86-4008-B2C7-30473A4548B4} {C368B363-4384-46B2-BE7E-6F66D3838E71} 3300
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5328
                                                  • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                    "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=960 -burn.embedded BurnPipe.{1CC06DBB-9954-45BC-ADFB-F3E4C264C682} {B4CF9140-39C3-4B14-910F-B23DCCBF2734} 5328
                                                    6⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2908
                                                    • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                      "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0b5169e3-39da-4313-808e-1f9c0407f3bf} -burn.filehandle.self=960 -burn.embedded BurnPipe.{1CC06DBB-9954-45BC-ADFB-F3E4C264C682} {B4CF9140-39C3-4B14-910F-B23DCCBF2734} 5328
                                                      7⤵
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2012
                                                      • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                                                        "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{49B70C63-2A2B-4F1E-9CBB-FB7061CE41B4} {2AFAFB64-1851-4F69-9551-9CFC1A1B1035} 2012
                                                        8⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        PID:4300
                                            • C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Auto Update.exe
                                              "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Auto Update.exe" -update
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3468
                                              • C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
                                                "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4740
                                                • C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
                                                  "C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe" -restart
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:1404
                                                  • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                    "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-component-update --disable-default-apps --disable-dev-shm-usage --disable-extensions --disable-field-trial-config --disable-hang-monitor --disable-infobars --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-search-engine-choice-screen --disable-sync --enable-automation --enable-blink-features=IdleDetection --export-tagged-pdf --generate-pdf-document-outline --force-color-profile=srgb --metrics-recording-only --no-first-run --password-store=basic --use-mock-keychain --disable-features=Translate,AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold --enable-features= about:blank --disable-web-security --window-size="880,740" --window-position="520,146" --remote-debugging-port=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq"
                                                    6⤵
                                                    • Uses browser remote debugging
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in Windows directory
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2020
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler --monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f937cc70,0x7ff9f937cc7c,0x7ff9f937cc88
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5380
                                                      • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                        C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Crashpad --annotation=plat=Win64 "--annotation=prod=Google Chrome for Testing" --annotation=ver=124.0.6367.201 --initial-client-data=0x130,0x134,0x138,0xfc,0x13c,0x7ff772d69900,0x7ff772d6990c,0x7ff772d69918
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:808
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=gpu-process --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:428
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --start-stack-profiler --field-trial-handle=2084,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:3
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5004
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --field-trial-handle=2260,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:4632
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2892,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
                                                      7⤵
                                                      • Uses browser remote debugging
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:3400
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2896,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:1
                                                      7⤵
                                                      • Uses browser remote debugging
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5560
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --start-stack-profiler --disable-background-timer-throttling --disable-breakpad --enable-automation --force-color-profile=srgb --remote-debugging-port=0 --allow-pre-commit-input --disable-gpu-compositing --enable-blink-features=IdleDetection --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
                                                      7⤵
                                                      • Uses browser remote debugging
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5216
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --field-trial-handle=4800,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:4692
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --field-trial-handle=492,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:3440
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --field-trial-handle=4868,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:4292
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --field-trial-handle=4912,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:2356
                                                    • C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                      "C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq" --no-appcompat-clear --field-trial-handle=5132,i,14874934886706625949,3914032977012935165,262144 --disable-features=AcceptCHFrame,MediaRouter,OptimizationHints,ProcessPerSiteUpToMainFrameThreshold,Translate --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      PID:5564
                                        • C:\Windows\system32\vssvc.exe
                                          C:\Windows\system32\vssvc.exe
                                          1⤵
                                          • Checks SCSI registry key(s)
                                          PID:1120
                                        • C:\Windows\system32\srtasks.exe
                                          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                          1⤵
                                            PID:4160
                                          • C:\Windows\system32\msiexec.exe
                                            C:\Windows\system32\msiexec.exe /V
                                            1⤵
                                            • Badlisted process makes network request
                                            • Enumerates connected drives
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Modifies registry class
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4024
                                          • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                            "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /burn.runonce
                                            1⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:4272
                                            • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                              "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503175146.log"
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5116
                                              • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503175146.log"
                                                3⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:1164
                                                • C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe
                                                  "C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{D7403805-A3A7-46AE-8851-1546D0BBA34A} {B1BAAFD5-0E26-4A47-8EA1-10373DBFE63D} 1164
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:3152
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:5316

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  e5a1ddf.rbs
                                                  • Path C:\Config.Msi\e5a1ddf.rbs
                                                  • Size 16KB
                                                  • SHA256 f7a4669f80b7828b18cfde8e3d1b3801be08dc5b062edefd77db9ee57fa1e210
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  e5a1de4.rbs
                                                  • Path C:\Config.Msi\e5a1de4.rbs
                                                  • Size 18KB
                                                  • SHA256 d71ee07ee683210673228029eda440c54cfc537d475407c26b164dd70c774b35
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  e5a1df1.rbs
                                                  • Path C:\Config.Msi\e5a1df1.rbs
                                                  • Size 20KB
                                                  • SHA256 de6e04c1db48a89514252118e9cf082b1811b8a27648a87a8399b419324161ca
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  e5a1e00.rbs
                                                  • Path C:\Config.Msi\e5a1e00.rbs
                                                  • Size 19KB
                                                  • SHA256 dd7b99cdfc4e5815fec80a488dba7f42795d5e83571363f62e6758dc3916e306
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  state.rsm
                                                  • Path C:\ProgramData\Package Cache\{0b5169e3-39da-4313-808e-1f9c0407f3bf}\state.rsm
                                                  • Size 914B
                                                  • SHA256 74d8b860d1c83f3f8bd8475909411851ab97f21f923c5a936af422a91ece5999
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  475e5f3e-f1d9-43b5-a459-2bffd5d59b59.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\475e5f3e-f1d9-43b5-a459-2bffd5d59b59.tmp
                                                  • Size 6B
                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  BrowsingTopicsState
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                  • Size 414B
                                                  • SHA256 d9dc5732d701556bf9d8797922c87ed81d0ffa43422e85a4638a74c8d3b4a64c
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 3KB
                                                  • SHA256 d6559c9c9bbc9568871b5cf06a9a89129c2e10c23b5c86351820cdad4b1c777c
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Network Persistent State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                  • Size 8KB
                                                  • SHA256 e3dd5cb8a40b0cc86db24838bd2e4f3a4919cbfc04b6102272ac777131753e71
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  SCT Auditing Pending Reports
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                  • Size 2B
                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                  • Size 13KB
                                                  • SHA256 356c9f95e050958a150742679d828034c8d5bbfa99c1113b0618eb869a4c0c47
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                  • Size 13KB
                                                  • SHA256 204cd041f1861cec66b2a122114ac29fffe90a6fd1337136a8d04530a02cc9d9
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                  • Size 14KB
                                                  • SHA256 ec20b3d5570db81c9fa8b99f67f450020e667a775019d8a703790ecb719838bc
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                  • Size 17KB
                                                  • SHA256 b348ef89a2004de3932b2d422cfbadcb8511ef1f7a57517647d45e46cced5182
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                  • Size 120B
                                                  • SHA256 904dc1738393f158b56ae22c234a92415e88af056a59d3c263150f5c66d346ef
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe5933f7.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5933f7.TMP
                                                  • Size 96B
                                                  • SHA256 1659f8c81301b4a1498941696c88ad225fc7517f27c6c036eb8792e9f8a5d8d1
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                  • Size 72B
                                                  • SHA256 473a2830115493c8ae6409941bc20c22f7033a36bb7950b8550147f3914eaa02
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 90KB
                                                  • SHA256 777063bfe2a5736a1ceda08f2a5ade311375b2a4f36f1905e692223830157e60
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 198KB
                                                  • SHA256 a2028dc3e7dc0b15acc86d0dd630a3cdeae76ca64705c2f43d2bfbd7490d01f5
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 199KB
                                                  • SHA256 5e3406a64c37ac6685b8c6a6bd361a38bd6a02a0a0a101e34a6d8532adb17843
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 199KB
                                                  • SHA256 d8ac2f68e646664a42a789c40eaad6c63ed49ded074c6295954c27f8ca080588
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 199KB
                                                  • SHA256 eb508dfabb1408d5eac7c2a92cc75eb887f36ba64d02c68e7617fe2e71b61d29
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                  • Size 198KB
                                                  • SHA256 85b56d3363b9adf1eca278b2a8ed7a1d19ae0299971fb88c7e94af149401bf56
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Roblox Account Manager.exe.log
                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Roblox Account Manager.exe.log
                                                  • Size 1KB
                                                  • SHA256 180f825c19263ae06fc891efcde51f993b720a27bd6e563742a110b40cb3fe41
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  vk_swiftshader_icd.json
                                                  • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\ChromeHeadlessShell\Win64-124.0.6367.201\chrome-headless-shell-win64\vk_swiftshader_icd.json
                                                  • Size 106B
                                                  • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  chrome.exe
                                                  • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome.exe
                                                  • Size 2.5MB
                                                  • SHA256 613536f294de53d1e9bb53a31269300fef4427f5e461ff6c7a1de3fa88c7667c
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  chrome_elf.dll
                                                  • Path C:\Users\Admin\AppData\Local\PuppeteerSharp\Chrome\Win64-124.0.6367.201\chrome-win64\chrome_elf.dll
                                                  • Size 1.2MB
                                                  • SHA256 0d2ccf801ceabba978a77238e1b79afc9a66983a11c07e011f876c063a71ffdb
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  dd_vcredist_x86_20260503175146.log
                                                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503175146.log
                                                  • Size 17KB
                                                  • SHA256 777831e640a5e5e158fd668f7ba1602690ece9ae02c28e8c57ad8162dc059822
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  dd_vcredist_x86_20260503175146_000_vcRuntimeMinimum_x86.log
                                                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503175146_000_vcRuntimeMinimum_x86.log
                                                  • Size 2KB
                                                  • SHA256 f6439acece2d27e7fe554eea19a60929b7b1b1b351acf26290d745357e352c00
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  dd_vcredist_x86_20260503175146_001_vcRuntimeAdditional_x86.log
                                                  • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_x86_20260503175146_001_vcRuntimeAdditional_x86.log
                                                  • Size 12KB
                                                  • SHA256 778ea81fb40bab5ba7023caa3dc7f9152ad5c437d0a09162f8973e2e372bb6bf
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 3KB
                                                  • SHA256 43f669b9590935a08dfcf76ae62d124956236675e9bb1ef279f616c6626b454b
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Code Cache\js\index-dir\the-real-index
                                                  • Size 3KB
                                                  • SHA256 bee2ec596e068a9da49bdac041ed5ddb2aff7b4d94da6a54397495eb41e46ac4
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  the-real-index~RFe5b76b3.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Code Cache\js\index-dir\the-real-index~RFe5b76b3.TMP
                                                  • Size 48B
                                                  • SHA256 9c3f47b3a826bac47e1245f00fbb2e218934d2076bddbc4a662d2b56d30b8c65
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  MANIFEST-000001
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Extension Rules\MANIFEST-000001
                                                  • Size 41B
                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Network Persistent State
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\Network Persistent State
                                                  • Size 2KB
                                                  • SHA256 9e9a6a964a8db6f82ef8eaf8a8224b6902eceb5baa8bc3c947a4b4109d8e09ca
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Network Persistent State~RFe5bf99f.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\Network Persistent State~RFe5bf99f.TMP
                                                  • Size 59B
                                                  • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  TransportSecurity
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\TransportSecurity
                                                  • Size 1KB
                                                  • SHA256 91957287077e7c9872ddfb18f19745950acb88c0c894ce45374998ab006db5ef
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  TransportSecurity
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\TransportSecurity
                                                  • Size 2KB
                                                  • SHA256 7516af63cc246f1c5be9328e1a4384777fd0a9580672e5868259b1ef8301ff4c
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  TransportSecurity
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\TransportSecurity
                                                  • Size 2KB
                                                  • SHA256 bf5f77673aa5221597e6d8abc15df52b69fa2702d34be3e7dd18629f0b828ffa
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  TransportSecurity
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\TransportSecurity
                                                  • Size 1KB
                                                  • SHA256 a1b1a9f6073fa9d8e7aa917c256e8f2546f59b560675072bb29bde6d20af59b6
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  TransportSecurity~RFe5b602d.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Network\TransportSecurity~RFe5b602d.TMP
                                                  • Size 1KB
                                                  • SHA256 2c0e5bff5fe49f2b6614254760dd9a8cbbb7444940eb1a02334ad24c64f8b285
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Preferences
                                                  • Size 5KB
                                                  • SHA256 a0c195080ec2f72edfa86cfdc225b448c544510efb507e2e6a29d240d4525fae
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Preferences
                                                  • Size 5KB
                                                  • SHA256 7f73f3cdbae5d440e57d1b0549fdfd039753373541af034aec72d4a5db900db2
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Preferences
                                                  • Size 6KB
                                                  • SHA256 f1bc5d5e1b459fa9feafd6ddbb4fb11486e7021882f6f2b9df3cc453529f9a9a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Preferences~RFe5b6e28.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Preferences~RFe5b6e28.TMP
                                                  • Size 5KB
                                                  • SHA256 3373c9f0a4c701732d8438249d6d9ebb1d26d78a405a56f3add8dd4c00753761
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Secure Preferences
                                                  • Size 4KB
                                                  • SHA256 4abf8709379b17f28e1daa736c19878df4840f249cd8e009de7735f765f1776d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Secure Preferences~RFe5bf99f.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Secure Preferences~RFe5bf99f.TMP
                                                  • Size 4KB
                                                  • SHA256 ee71b816e7574b2280c15550693a61d96d841116c8ad399a56fe97b24bef31b0
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  CURRENT
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Default\Site Characteristics Database\CURRENT
                                                  • Size 16B
                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  data_0
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\GrShaderCache\data_0
                                                  • Size 8KB
                                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_2
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\GrShaderCache\data_2
                                                  • Size 8KB
                                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_3
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\GrShaderCache\data_3
                                                  • Size 8KB
                                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  data_1
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\GraphiteDawnCache\data_1
                                                  • Size 264KB
                                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                  • MD5 SHA1 SHA512 SSDEEP
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Local State
                                                  • Size 3KB
                                                  • SHA256 c171968af59b45748eebf5945694cd955b10ed013a8fdcac42c039d948112236
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Local State
                                                  • Size 3KB
                                                  • SHA256 13ebce81347000f82a2622a2c7c89abf77448c60745f7211acb260050659ea49
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Local State
                                                  • Size 3KB
                                                  • SHA256 c246c97c83e50dd2307c5e006341e6f2c9cea1b3b9908a67563e355b585b09ea
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Local State~RFe5b3313.TMP
                                                  • Path C:\Users\Admin\AppData\Local\Temp\rvb3ouns.zsq\Local State~RFe5b3313.TMP
                                                  • Size 914B
                                                  • SHA256 81552f2ec41efc8e8c14f37ecbfaf053e84f80033c0c1adea4c0b0bf541a3fa5
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  vcredist.tmp
                                                  • Path C:\Users\Admin\AppData\Local\Temp\vcredist.tmp
                                                  • Size 13.3MB
                                                  • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  default.dic
                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                  • Size 2B
                                                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  Roblox.Account.Manager.3.6.1.zip.crdownload
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1.zip.crdownload
                                                  • Size 4.0MB
                                                  • SHA256 1b94210a7a05ce8379db7b8c11d41f84bc868cbdcd0685733754728678bb5fa2
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Roblox.Account.Manager.3.6.1.zip:Zone.Identifier
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1.zip:Zone.Identifier
                                                  • Size 1KB
                                                  • SHA256 77e3c9256649da8558921abdc2c6c3645f13cd2c940d1243cf075490b7fb197c
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Auto Update.exe
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Auto Update.exe
                                                  • Size 5.2MB
                                                  • SHA256 cdb0a360cca7a5099c2d2357be1a833e032ffdeb3f467a6fac845f6bb77031c9
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  RAMSettings.ini
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\RAMSettings.ini
                                                  • Size 1KB
                                                  • SHA256 fbbf21c6c6a3594b126ad1e48a06e315478022b6fa54ab0dc54b9ddaf30089ee
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  RAMSettings.ini
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\RAMSettings.ini
                                                  • Size 979B
                                                  • SHA256 1df09256c36fd4688402dcb748319d78827606aa53686bffdf709aa43d6765c7
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  RAMTheme.ini
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\RAMTheme.ini
                                                  • Size 314B
                                                  • SHA256 563eb35fd613f4298cd4dceff67652a13ba516a6244d9407c5709323c4ca4bb1
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  Roblox Account Manager.exe
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe
                                                  • Size 5.4MB
                                                  • SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Roblox Account Manager.exe.config
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe.config
                                                  • Size 6KB
                                                  • SHA256 2b6d99db8369b0ff6372737d89d1c9e4101815b4168a3852c7b513f2897e7f3d
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  Roblox Account Manager.exe.config
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\Roblox Account Manager.exe.config
                                                  • Size 5KB
                                                  • SHA256 5e0ba1895cf088e6d6907b8abbd8cd41c86f39cc642351a9ab0bf458bf1f5b31
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  libsodium.dll
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\libsodium.dll
                                                  • Size 477KB
                                                  • SHA256 7a960129f6d3f8d44b4c6be27f587c29aa8bafb9c4d3c85bb84a5f5d8fa6e2ba
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  log.txt
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\log.txt
                                                  • Size 569B
                                                  • SHA256 32647e3ffe9fddb91ebdac3b4459c00970860e67df3dbf0b391c0582dea79b8a
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  log.txt
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\log.txt
                                                  • Size 142B
                                                  • SHA256 3368898226b9d483af865872c4b21804e61b647c13f9c0e1b555812f60682b2f
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  log4.config
                                                  • Path C:\Users\Admin\Downloads\Roblox.Account.Manager.3.6.1\Roblox Account Manager\log4.config
                                                  • Size 936B
                                                  • SHA256 e4b10630d9ec2af508de31752fbbc6816c7426c40a3e57f0a085ce7f42c77bd5
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  vcruntime140.dll
                                                  • Path C:\Windows\SysWOW64\vcruntime140.dll
                                                  • Size 89KB
                                                  • SHA256 a9d7732a3c3de09f0601a7fa2555093dcb49f08e2fc62a86091461f0f38393ed
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  vcredist.tmp
                                                  • Path C:\Windows\Temp\{0C4DA008-F976-43DF-9882-35608CC61EF5}\.cr\vcredist.tmp
                                                  • Size 669KB
                                                  • SHA256 4a6e1044ff0f49d2e3b12f7c40352c7e573e0c58f3b3cc0b55b63c95ede87828
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  license.rtf
                                                  • Path C:\Windows\Temp\{5908A13C-9400-4B69-B7DB-6A6AE5BF2AD2}\.ba\license.rtf
                                                  • Size 9KB
                                                  • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  thm.wxl
                                                  • Path C:\Windows\Temp\{5908A13C-9400-4B69-B7DB-6A6AE5BF2AD2}\.ba\thm.wxl
                                                  • Size 2KB
                                                  • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  thm.xml
                                                  • Path C:\Windows\Temp\{5908A13C-9400-4B69-B7DB-6A6AE5BF2AD2}\.ba\thm.xml
                                                  • Size 8KB
                                                  • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  wixstdba.dll
                                                  • Path C:\Windows\Temp\{5908A13C-9400-4B69-B7DB-6A6AE5BF2AD2}\.ba\wixstdba.dll
                                                  • Size 191KB
                                                  • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  logo.png
                                                  • Path C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\.ba\logo.png
                                                  • Size 1KB
                                                  • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  wixstdba.dll
                                                  • Path C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\.ba\wixstdba.dll
                                                  • Size 215KB
                                                  • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  cab54A5CABBE7274D8A22EB58060AAB7623
                                                  • Path C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\cab54A5CABBE7274D8A22EB58060AAB7623
                                                  • Size 838KB
                                                  • SHA256 c9935322c0af2fe00ebb018f8b0b908018576048fa4d3c0376a30ebf0eb2cf50
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  cabB3E1576D1FEFBB979E13B1A5379E0B16
                                                  • Path C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\cabB3E1576D1FEFBB979E13B1A5379E0B16
                                                  • Size 4.9MB
                                                  • SHA256 01b11076177c8a5ee37eba745142cd6bbc4ac1ebfc4ebe48c85bd285a73ebf60
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  vcRuntimeAdditional_x86
                                                  • Path C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\vcRuntimeAdditional_x86
                                                  • Size 200KB
                                                  • SHA256 3e4a528fe5263a5dc44455d0ab2717f0c02acdc120c918cf43730ce9f36ccbb5
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  vcRuntimeMinimum_x86
                                                  • Path C:\Windows\Temp\{73770290-CB9B-4983-8A2A-3FAEDF967EFB}\vcRuntimeMinimum_x86
                                                  • Size 200KB
                                                  • SHA256 c5ff4d6cd4be9f4965f93af273dd364948fbe44d40b123f34f82bcbcf64c8df4
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  memory/428-1870-0x000001D8D1AD0000-0x000001D8D1C6A000-memory.dmp
                                                  Download

                                                  memory/1120-897-0x00000203B6690000-0x00000203B682A000-memory.dmp
                                                  Download

                                                  memory/1120-1117-0x00000203B6690000-0x00000203B682A000-memory.dmp
                                                  Download

                                                  memory/1404-1157-0x0000000005430000-0x0000000005444000-memory.dmp
                                                  Download

                                                  memory/1404-1366-0x00000000054F0000-0x0000000005500000-memory.dmp
                                                  Download

                                                  memory/1404-1010-0x00000000061B0000-0x0000000006224000-memory.dmp
                                                  Download

                                                  memory/1404-2262-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1087-0x000000000AB50000-0x000000000ABF0000-memory.dmp
                                                  Download

                                                  memory/1404-1448-0x000000000CDB0000-0x000000000CDBA000-memory.dmp
                                                  Download

                                                  memory/1404-1101-0x000000000B5F0000-0x000000000B6E4000-memory.dmp
                                                  Download

                                                  memory/1404-1879-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1075-0x000000000AA40000-0x000000000AA7A000-memory.dmp
                                                  Download

                                                  memory/1404-1969-0x00000000012B0000-0x00000000012C6000-memory.dmp
                                                  Download

                                                  memory/1404-1367-0x0000000005500000-0x0000000005514000-memory.dmp
                                                  Download

                                                  memory/1404-1996-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1123-0x0000000005290000-0x000000000529B000-memory.dmp
                                                  Download

                                                  memory/1404-1122-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1177-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1128-0x00000000056E0000-0x00000000056F4000-memory.dmp
                                                  Download

                                                  memory/1404-1130-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1132-0x0000000005740000-0x0000000005790000-memory.dmp
                                                  Download

                                                  memory/1404-1133-0x00000000056F0000-0x00000000056F8000-memory.dmp
                                                  Download

                                                  memory/1404-2250-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1158-0x0000000005460000-0x000000000549E000-memory.dmp
                                                  Download

                                                  memory/1404-1141-0x000000000C530000-0x000000000C887000-memory.dmp
                                                  Download

                                                  memory/1404-1144-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1153-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1404-1155-0x0000000005400000-0x000000000540A000-memory.dmp
                                                  Download

                                                  memory/1404-1156-0x0000000005410000-0x000000000541A000-memory.dmp
                                                  Download

                                                  memory/1404-1510-0x0000000005200000-0x000000000528A000-memory.dmp
                                                  Download

                                                  memory/1600-563-0x0000000000430000-0x000000000096E000-memory.dmp
                                                  Download

                                                  memory/1600-576-0x0000000005500000-0x0000000005582000-memory.dmp
                                                  Download

                                                  memory/1600-567-0x0000000005470000-0x0000000005496000-memory.dmp
                                                  Download

                                                  memory/1600-566-0x00000000055A0000-0x0000000005632000-memory.dmp
                                                  Download

                                                  memory/1600-564-0x0000000005AB0000-0x0000000006056000-memory.dmp
                                                  Download

                                                  memory/1600-565-0x00000000053E0000-0x0000000005426000-memory.dmp
                                                  Download

                                                  memory/2012-1095-0x0000000000A50000-0x0000000000AC7000-memory.dmp
                                                  Download

                                                  memory/2020-2255-0x0000025F094F0000-0x0000025F0968A000-memory.dmp
                                                  Download

                                                  memory/2020-1860-0x0000025F094F0000-0x0000025F0968A000-memory.dmp
                                                  Download

                                                  memory/2348-35-0x0000024A77D50000-0x0000024A77EEA000-memory.dmp
                                                  Download

                                                  memory/2356-2006-0x0000026F58380000-0x0000026F5851A000-memory.dmp
                                                  Download

                                                  memory/2908-1096-0x0000000000A50000-0x0000000000AC7000-memory.dmp
                                                  Download

                                                  memory/3300-666-0x0000000002910000-0x00000000029CF000-memory.dmp
                                                  Download

                                                  memory/3440-1941-0x0000018DBF890000-0x0000018DBFA2A000-memory.dmp
                                                  Download

                                                  memory/3452-590-0x0000000007DE0000-0x0000000007E38000-memory.dmp
                                                  Download

                                                  memory/3452-860-0x0000000001D30000-0x0000000001D3B000-memory.dmp
                                                  Download

                                                  memory/3452-600-0x000000000ECB0000-0x000000000ECBA000-memory.dmp
                                                  Download

                                                  memory/3452-597-0x000000000D5C0000-0x000000000D5C8000-memory.dmp
                                                  Download

                                                  memory/3452-598-0x000000000D5B0000-0x000000000D5B8000-memory.dmp
                                                  Download

                                                  memory/3452-653-0x0000000001D30000-0x0000000001D3B000-memory.dmp
                                                  Download

                                                  memory/3452-652-0x0000000005C10000-0x0000000005C9A000-memory.dmp
                                                  Download

                                                  memory/3452-596-0x00000000081A0000-0x00000000081BE000-memory.dmp
                                                  Download

                                                  memory/3452-595-0x0000000008170000-0x000000000818A000-memory.dmp
                                                  Download

                                                  memory/3452-594-0x00000000080B0000-0x000000000816E000-memory.dmp
                                                  Download

                                                  memory/3452-593-0x0000000008080000-0x00000000080A2000-memory.dmp
                                                  Download

                                                  memory/3452-592-0x0000000007E70000-0x0000000007F22000-memory.dmp
                                                  Download

                                                  memory/3452-580-0x00000000063D0000-0x0000000006444000-memory.dmp
                                                  Download

                                                  memory/3452-585-0x000000000B950000-0x000000000B95A000-memory.dmp
                                                  Download

                                                  memory/3452-581-0x0000000006D40000-0x0000000006D4A000-memory.dmp
                                                  Download

                                                  memory/3452-676-0x000000000C430000-0x000000000C442000-memory.dmp
                                                  Download

                                                  memory/3452-584-0x000000000BE20000-0x000000000BEB2000-memory.dmp
                                                  Download

                                                  memory/3452-859-0x0000000005C10000-0x0000000005C9A000-memory.dmp
                                                  Download

                                                  memory/3452-583-0x000000000B2E0000-0x000000000B314000-memory.dmp
                                                  Download

                                                  memory/3468-962-0x00000000050E0000-0x00000000050EB000-memory.dmp
                                                  Download

                                                  memory/3468-891-0x0000000009770000-0x00000000097E6000-memory.dmp
                                                  Download

                                                  memory/3468-961-0x0000000005030000-0x00000000050BA000-memory.dmp
                                                  Download

                                                  memory/3468-951-0x0000000006840000-0x000000000685E000-memory.dmp
                                                  Download

                                                  memory/4024-1119-0x0000021FA2090000-0x0000021FA222A000-memory.dmp
                                                  Download

                                                  memory/4024-1120-0x0000021FA2AD0000-0x0000021FA2ADC000-memory.dmp
                                                  Download

                                                  memory/4160-1124-0x000002049AC30000-0x000002049ADCA000-memory.dmp
                                                  Download

                                                  memory/4160-1118-0x000002049AC30000-0x000002049ADCA000-memory.dmp
                                                  Download

                                                  memory/4292-1942-0x0000021502D40000-0x0000021502EDA000-memory.dmp
                                                  Download

                                                  memory/4300-1093-0x0000000000A50000-0x0000000000AC7000-memory.dmp
                                                  Download

                                                  memory/4692-1694-0x000001F08B9B0000-0x000001F08BB4A000-memory.dmp
                                                  Download

                                                  memory/4740-1003-0x0000000005C00000-0x0000000005C8A000-memory.dmp
                                                  Download

                                                  memory/4740-973-0x0000000000E40000-0x00000000013AC000-memory.dmp
                                                  Download

                                                  memory/4740-977-0x0000000005D00000-0x0000000005D46000-memory.dmp
                                                  Download

                                                  memory/4740-1004-0x0000000005D50000-0x0000000005D5B000-memory.dmp
                                                  Download

                                                  memory/5052-13-0x0000025092FB0000-0x000002509314A000-memory.dmp
                                                  Download

                                                  memory/5564-1985-0x000001E91A3C0000-0x000001E91A55A000-memory.dmp
                                                  Download